SCIM provisioning fails due to network accessibility requirement

Symptom

SCIM provisioning with Azure AD, Okta, or other Identity Providers fails during connection test or user/group synchronization.

Observed behavior includes:

• Connection test fails in IdP provisioning configuration
• Provisioning shows timeout or no response from SCIM endpoint
• Error indicating the provisioning service did not receive a response from the target system
• SCIM configuration (URL and token) appears correct but still fails

Cause

SCIM provisioning is initiated from the Identity Provider cloud service. Therefore, the Strategy Library SCIM endpoint must be reachable from the IdP network:

The issue occurs when:

• Library is only accessible via VPN or internal network
• Firewall / WAF blocks external IdP access
• No public or proxy exposure is configured for SCIM endpoint

In these cases, the IdP cannot reach the SCIM service, causing provisioning failure.

Important Note:

• This requirement applies to all SCIM Identity Providers (e.g., Azure AD, Okta, or any SCIM-compliant IdP)
• SCIM connectivity is determined by the network path between the Identity Provider provisioning service and Strategy Library
• Client-side VPN access does not satisfy SCIM connectivity requirements

Solution

Ensure the SCIM endpoint is reachable from the Identity Provider by:

• Exposing Library SCIM endpoint via HTTPS, or
• Configuring reverse proxy / WAF to allow access from Identity Provider systems, or
• Providing a supported network route for SCIM traffic

Validate accessibility:

Expected: Endpoint is reachable (HTTP response returned)

Key Takeaway

SCIM provisioning requires network connectivity between the Identity Provider provisioning service and Strategy Library.

If this connectivity is not available, SCIM provisioning will fail regardless of correct URL or token configuration.